Not scored
CVE-2026-0920
LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter
choijunLA-Studio Element Kit for Elementor
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 25 Oct
1.1%probability of exploitation in the next 30 days
Higher than 66% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and including, 1.5.6.3. This is due to the 'ajax_register_handle' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'lakit_bkrole' parameter during registration and gain administrator access to the site.
Coverage 1 article · 1 outlet
- Sabotage & Exploited in the Wild: Critical Backdoor Found in LA-Studio Element KitSecurityOnline · first in our coverage